Description

The Add-VpnS2SInterface cmdlet creates a site-to-site (S2S) interface with the specified parameters.
Use the CustomPolicy parameter to customize IPsec settings.
If the Protocol parameter is set to Automatic, then the only authentication method allowed is user name.
If the AuthenticationMethod parameter is set to pre-shared key (PSK), then only one interface can be enabled per destination and the initiator and responder policies are governed by what is specified per interface.
If the AuthenticationMethod parameter is set to user name or computer certificates (MachineCert), then only initiator policies are governed by what is specified per interface and responder policies are governed by what is specified on the server.

For incoming connections:

-- If the AuthenticationMethod parameter is set to PSK, the interface for which the destination IP matches the incoming IP is activated.

-- If the AuthenticationMethod parameter is set to user name, then the name of the interface that matches the user name is activated.

-- If the AuthenticationMethod parameter is set to certificates, then the name of the interface that matches the certificate subject name is activated.

Examples

This example creates a S2S VPN interface named edge1 to the destination server 131.107.0.20.
The protocol is IKEv2 and the authentication method is PSK.
The string abc is used as PSK.
Traffic to 10.2.0.0/24 and 2001:db8:2::/48 is sent over this interface if there is no other interface on the server that has same routes with a metric less than 100 .
In case the interface is in disconnected state the connection is triggered if there is no other interface on the server that has same routes with a metric less than 100.

This example creates a S2S interface with authentication method of computer certificate and specifies the certificate for which the subject name is edge1.contoso.com.

Required Parameters

-CustomPolicy

Specifies the custom IKE IPsec policies.

Type:

SwitchParameter

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-Destination

Specifies the destination end point of the S2S connection.
Note: If the Certificate parameter is specified as PSK, then an IP address should be specified for this parameter as a fully qualified domain name (FQDN) will not work.

Type:

String[]

Aliases:

RemoteTunnelEndpoint, RemoteTunnelHostname, RemoteAddress

Position:

2

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-Name

Specifies the name of the connection.

Type:

String

Aliases:

ElementName

Position:

1

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

Optional Parameters

-AdminStatus

Specifies the administrator status of the cmdlet.

Type:

Boolean

Position:

Named

Default value:

True

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-AsJob

ps_cimcommon_asjob

Type:

SwitchParameter

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-AuthenticationMethod

Specifies the authentication method to be used by the S2S connection.

If PSK is specified, then there can only be one active S2S VPN interface per destination IP address.

Type:

String

Parameter Sets:

EAP, MachineCertificates, PSKOnly,

Position:

Named

Default value:

EAP

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-AuthenticationTransformConstants

Specifies a transform constant.
The acceptable values for this parameter are:

SHA256128

MD596

SHA196

GCMAES128

GCMAES192

GCMAES256

Type:

AuthenticationTransformConstants

Aliases:

FirstTransformType, AuthenticationTransformConstant

Parameter Sets:

MD596, SHA196, SHA256128, GCMAES128, GCMAES192, GCMAES256, None

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-Certificate

Specifies the certificate to be used in default store.
Applicable only if AuthenticationMethod parameter is set to MachineCert.

Type:

X509Certificate2

Aliases:

Cert

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-CimSession

Runs the cmdlet in a remote session or on a remote computer.
Enter a computer name or a session object, such as the output of a New-CimSessionhttp://go.microsoft.com/fwlink/p/?LinkId=227967 or Get-CimSessionhttp://go.microsoft.com/fwlink/p/?LinkId=227966 cmdlet.
The default is the current session on the local computer.

Type:

CimSession[]

Aliases:

Session

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-CipherTransformConstants

Specifies a cipher transform constant.
The acceptable values for this parameter are:

Specifies the time interval, in seconds, after which an idle connection is disconnected.
Unless you disable idle timeout, an idle connection is disconnected after this time interval is reached.

Type:

UInt32

Aliases:

IdleDurationSeconds, IdleDisconnectSec

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-InitiateConfigPayload

Indicates whether to initiate Config payload negotiation.

Type:

Boolean

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-IntegrityCheckMethod

Specifies the integrity method for the IPsec policy.

Type:

IntegrityCheckMethod

Aliases:

OtherHashAlgorithm, FirstIntegrityAlgorithm

Parameter Sets:

MD5, SHA1, SHA256, SHA384

Position:

Named

Default value:

2

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-InternalIPv4

Specifies that the IPv4 address should be negotiated.

Type:

Boolean

Position:

Named

Default value:

True

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-InternalIPv6

Specifies that the IPv6 address should be negotiated.

Type:

Boolean

Position:

Named

Default value:

True

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-NetworkOutageTimeSeconds

Specifies the maximum amount of time, in seconds, before a connection is disconnected due to a network outage.

Type:

UInt32

Aliases:

NetworkOutageTimeSec

Parameter Sets:

3, 6, 9, 12, 15, 30, 60, 120, 240, 360, 720, 900

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-NumberOfTries

Specifies the number of connection attempts.

If this parameter is specified as zero (0), then the connection is not retried if the first attempt fails.

Type:

UInt32

Position:

Named

Default value:

3

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-PassThru

Returns an object representing the item with which you are working.
By default, this cmdlet does not generate any output.

Type:

SwitchParameter

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-Password

Specifies the password for the user name to be used for dialing the connection.
Applicable only if AuthenticationMethod parameter is set to EAP.

Type:

String

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-Persistent

Indicates that a connection is not disconnected due to inactivity.

Type:

SwitchParameter

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-PfsGroup

Specifies the PFS group in the IPsec policy.

Type:

PfsGroup

Aliases:

PfsGroupId

Parameter Sets:

None, PFS1, PFS2, PFS2048, ECP256, ECP384, PFSMM, PFS24

Position:

Named

Default value:

3

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-PostConnectionIPv4Subnet

Specifies the IPv4 subnet routes that are added to a site-to-site interface after the connection is established.
The values specified are not used to initiate the site-to-site VPN connection.

Type:

String[]

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-PostConnectionIPv6Subnet

Specifies the IPv6 subnet routes that are added to a site-to-site interface after the connection is established.
The values specified are not used to initiate the site-to-site VPN connection.

Type:

String[]

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-PromoteAlternate

Specifies an IP address that if successfully connected becomes the primary IP address, and the current primary IP address is moved to the alternate list.

Type:

Boolean

Position:

Named

Default value:

False

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-Protocol

Specifies the underlying protocol used for tunneling.

Type:

String

Aliases:

KeyModule

Parameter Sets:

L2TP, IKEv2, Automatic

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-RadiusAttributeClass

Specifies a RADIUS attribute.

Type:

String

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-ResponderAuthenticationMethod

Specifies the authentication method to be used by the S2S initiator to validate the S2S responder.

Type:

String

Parameter Sets:

MachineCertificates, PSKOnly,

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-RetryIntervalSeconds

Specifies the time interval, in seconds, to wait between retries.

Type:

UInt32

Aliases:

RetryIntervalSec

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-RoutingDomain

Specifies an ID, as a string, for a routing domain.
The ID of a routing domain is a user-defined alphanumeric string.

Type:

String

Aliases:

RoutingDomainName

Position:

3

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-RxBandwidthKbps

Specifies the receive bandwidth limit, in kilobits per second (Kbps).

Type:

UInt64

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-SADataSizeForRenegotiationKilobytes

Specifies the amount of data, in kilobytes (KB), that can be transferred using a security association (SA).
When the limit is reached, the SA must be renegotiated.

Type:

UInt32

Aliases:

SaRenegotiationDataSizeKB, LifeTimeKiloBytes

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-SALifeTimeSeconds

Specifies the lifetime, in seconds, of a security association (SA).
The SA is no longer valid after this time interval.

Type:

UInt32

Aliases:

SaLifeTimeSec, LifeTimeSeconds

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-SharedSecret

Specifies the text of the shared secret to be used in the connection.
This parameter is only applicable only if the AuthenticationMethod parameter is set to PSK or the ResponderAuthenticationMethod parameter is set to PSK.

Type:

String

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-SourceIpAddress

Specifies the source IPv4 or IPv6 addresses to use when dialing the connection.

Type:

String

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-ThrottleLimit

Specifies the maximum number of concurrent operations that can be established to run the cmdlet.
If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer.
The throttle limit applies only to the current cmdlet, not to the session or to the computer.

Type:

Int32

Position:

Named

Default value:

None

Accept pipeline input:

False

Accept wildcard characters:

False

-TxBandwidthKbps

Specifies a transmit bandwidth limit, in Kbps, for the interface.

Type:

UInt64

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-UserName

Specifies the user name to be used for the connection.
Applicable only if AuthenticationMethod parameter is set to EAP.

Type:

String

Aliases:

User

Position:

Named

Default value:

None

Accept pipeline input:

True (ByPropertyName)

Accept wildcard characters:

False

-WhatIf

Shows what would happen if the cmdlet runs.
The cmdlet is not run.

Type:

SwitchParameter

Aliases:

wi

Position:

Named

Default value:

False

Accept pipeline input:

False

Accept wildcard characters:

False

Inputs

None

Outputs

Microsoft.Management.Infrastructure.CimInstance#VpnS2SInterface

The Microsoft.Management.Infrastructure.CimInstance object is a wrapper class that displays Windows Management Instrumentation (WMI) objects.
The path after the pound sign (#) provides the namespace and class name for the underlying WMI object.